CVSS 3.1
6.1 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2018-8032
Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.
Severity
- EPSS
- 11% chance of exploitation in the next 30 days; higher than 95% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:axis
- debian:debian_linux
- oracle:agile_engineering_data_management
- oracle:agile_product_lifecycle_management
- oracle:application_testing_suite
- oracle:big_data_discovery
- oracle:communications_asap_cartridges
- oracle:communications_design_studio
- oracle:communications_element_manager
- oracle:communications_network_integrity
- oracle:communications_order_and_service_management
- oracle:communications_session_report_manager
- oracle:communications_session_route_manager
- oracle:endeca_information_discovery_studio
- oracle:enterprise_manager_base_platform
- oracle:enterprise_manager_for_fusion_middleware
- oracle:financial_services_analytical_applications_infrastructure
- oracle:financial_services_compliance_regulatory_reporting
- oracle:financial_services_funds_transfer_pricing
- oracle:flexcube_core_banking
- oracle:flexcube_private_banking
- oracle:hospitality_guest_access
- oracle:instantis_enterprisetrack
- oracle:internet_directory
- oracle:knowledge
- oracle:peoplesoft_enterprise_human_capital_management_human_resources
- oracle:peoplesoft_enterprise_peopletools
- oracle:policy_automation_connector_for_siebel
- oracle:primavera_gateway
- oracle:primavera_unifier
- oracle:rapid_planning
- oracle:real-time_decision_server
- oracle:retail_order_broker
- oracle:retail_xstore_point_of_service
- oracle:secure_global_desktop
- oracle:siebel_ui_framework
- oracle:tuxedo
- oracle:webcenter_portal
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-96jq-75wh-2658 | Maven | org.apache.axis:axis | <=1.4 | no fix published |
| GHSA-96jq-75wh-2658 | Maven | axis:axis | <=1.4 | no fix published |
References
- http://mail-archives.apache.org/mod_mbox/axis-java-dev/201807.mbox/%3CJIRA.13170716.1531060536000.93536.1531060560060%40Atlassian.JIRA%3E
- https://issues.apache.org/jira/browse/AXIS-2924
- https://lists.apache.org/thread.html/3b89bc9e9d055db7eba8835ff6501f3f5db99d2a0928ec0be9b1d17b%40%3Cjava-dev.axis.apache.org%3E
- https://lists.apache.org/thread.html/d06ed5e4eeb77d00e8d594ec01ee8ee1cba173a01ac4b18f1579d041%40%3Cjava-dev.axis.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2021/11/msg00015.html